From e73a717dbda1d357f64d02e3f187108637a57fe1 Mon Sep 17 00:00:00 2001 From: Troy Grunt Date: Mon, 2 Feb 2026 23:11:41 +0100 Subject: [PATCH] =?UTF-8?q?Verbessere=20die=20Anmeldefunktionalit=C3=A4t:?= =?UTF-8?q?=20Aktualisiere=20Sicherheits=C3=BCberpr=C3=BCfungen,=20verbess?= =?UTF-8?q?ere=20die=20Benutzeroberfl=C3=A4che=20und=20implementiere=20UUI?= =?UTF-8?q?D-Management=20f=C3=BCr=20Identit=C3=A4ten.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- db/init/001_schema.sql | 2 + www/admin.php | 497 +++++++++++++++++++++++++++++------------ 2 files changed, 359 insertions(+), 140 deletions(-) diff --git a/db/init/001_schema.sql b/db/init/001_schema.sql index 662e4da..973f710 100644 --- a/db/init/001_schema.sql +++ b/db/init/001_schema.sql @@ -1,6 +1,7 @@ -- Identitäten CREATE TABLE identities ( id INT AUTO_INCREMENT PRIMARY KEY, + name VARCHAR(255) NOT NULL, created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ) ENGINE=InnoDB; @@ -8,6 +9,7 @@ CREATE TABLE identities ( CREATE TABLE identity_fields ( id INT AUTO_INCREMENT PRIMARY KEY, identity_id INT NOT NULL, + typ ENUM('single','multi','file') NULL, field_key VARCHAR(50) NOT NULL, field_value TEXT NOT NULL, FOREIGN KEY (identity_id) diff --git a/www/admin.php b/www/admin.php index 2215f93..486af47 100644 --- a/www/admin.php +++ b/www/admin.php @@ -4,118 +4,340 @@ require '_func.php'; require '_user.php'; session_start(); - $ip = $_SERVER['REMOTE_ADDR']; +/* ───────────────────────────── + Security +───────────────────────────── */ if (isIpLocked($ip, $sql)) { http_response_code(403); - exit('Zu viele Fehlversuche. IP für 1 Stunde gesperrt.'); + exit('Zu viele Fehlversuche.'); } +/* ───────────────────────────── + Login +───────────────────────────── */ if (!($_SESSION['is_admin'] ?? false)) { + if ($_SERVER['REQUEST_METHOD'] === 'POST') { - $user = $_POST['username'] ?? ''; - $pass = $_POST['password'] ?? ''; + $u = $_POST['username'] ?? ''; + $p = $_POST['password'] ?? ''; if ( - $user !== $admin_user || - $pass !== $admin_password + $u !== $admin_user || + $p !== $admin_password ) { registerFailedLogin($ip, $sql); - $error = 'Ungültige Zugangsdaten'; + $error = 'Login fehlgeschlagen'; } else { clearLoginAttempts($ip, $sql); $_SESSION['is_admin'] = true; header('Location: admin.php'); exit; } - - if (!$admin || !password_verify($pass, $admin['password_hash'])) { - registerFailedLogin($ip, $sql); - $error = 'Ungültige Zugangsdaten'; - } else { - clearLoginAttempts($ip, $sql); - $_SESSION['is_admin'] = true; - $_SESSION['admin_id'] = $admin['id']; - header('Location: admin.php'); - exit; - } } - - // 🔑 Login-Formular ?> - - - - - Admin Login - - - -
-

Admin Login

- - - - -
- -
- - - + + + +Admin Login + + + +
+

Admin Login

+ + + + +
+ +
+ + +single( "SELECT * FROM access_tokens WHERE uuid = ?", "s", [$uuid] ); - if (!$token) { - $sql->set( - "INSERT INTO access_tokens (identity_id, uuid) - VALUES (1, ?)", - "s", - [$uuid] - ); + if ($token) { + // UUID existiert → weiter zum edit-Formular + $action = 'uuid_edit'; + $_GET['uuid'] = $uuid; + } else { + // UUID existiert nicht → Initial-Form + $action = 'uuid_create_initial'; + $_GET['uuid'] = $uuid; + } +} - $token = $sql->single( - "SELECT * FROM access_tokens WHERE uuid = ?", - "s", - [$uuid] - ); +/* ───────────────────────────── + CREATE IDENTITY +───────────────────────────── */ +if ($action === 'identity_create') { + + if ($_SERVER['REQUEST_METHOD'] === 'POST') { + $name = trim($_POST['name'] ?? ''); + + if ($name !== '') { + $sql->set( + "INSERT INTO identities (name) VALUES (?)", + "s", + [$name] + ); + header('Location: admin.php'); + exit; + } + } + ?> + +Identität anlegen + +

Neue Identität

+
+ + +
+

← zurück

+ +get("SELECT * FROM identities ORDER BY name ASC"); + + if ($_SERVER['REQUEST_METHOD'] === 'POST') { + $identityId = (int)($_POST['identity_id'] ?? 0); + $notes = trim($_POST['notes'] ?? ''); + + if (!$identityId) { + $error = 'Bitte eine Identität auswählen.'; + } else { + // UUID anlegen + $sql->set( + "INSERT INTO access_tokens (identity_id, uuid, notes) VALUES (?, ?, ?)", + "iss", + [$identityId, $uuid, $notes] + ); + + // Weiterleiten zum Bearbeitungsformular + header("Location: admin.php?action=uuid_edit&uuid=$uuid"); + exit; + } + } + + ?> + + +Neue UUID anlegen + +

Neue UUID anlegen

+ +
+ +

+ +

+ +
+ + +

+ + +

← zurück zum Dashboard

+ + +single( + "SELECT * FROM identities WHERE id = ?", + "i", + [$id] + ); + + if (!$identity) { + exit('Identität nicht gefunden'); } if ($_SERVER['REQUEST_METHOD'] === 'POST') { - $issuedTo = $_POST['issued_to'] ?? ''; - $fields = $_POST['fields'] ?? []; - // Notiz speichern - $sql->set( - "UPDATE access_tokens SET notes = ? WHERE id = ?", - "si", - [$issuedTo, $token['id']] - ); + if (isset($_POST['rename'])) { + $sql->set( + "UPDATE identities SET name = ? WHERE id = ?", + "si", + [trim($_POST['name']), $id] + ); + } + + if (isset($_POST['add_field'])) { + $sql->set( + "INSERT INTO identity_fields (identity_id, field_key, field_value) + VALUES (?, ?, ?)", + "iss", + [$id, trim($_POST['key']), trim($_POST['value'])] + ); + //TODO typ + } + + header("Location: admin.php?action=identity_edit&id=$id"); + exit; + } + + $fields = $sql->get( + "SELECT * FROM identity_fields WHERE identity_id = ?", + "i", + [$id] + ); + ?> + +Identität bearbeiten + +

+ +
+ + +
+ +

Felder

+ + +
+ + + +
+ +

← zurück

+ +set( + "INSERT INTO access_tokens (identity_id, uuid) + VALUES (?, ?)", + "is", + [$identityId, $uuid] + ); + + header("Location: admin.php?action=uuid_edit&uuid=$uuid"); + exit; +} + +/* ───────────────────────────── + EDIT UUID +───────────────────────────── */ +if ($action === 'uuid_edit') { + + $uuid = $_GET['uuid'] ?? ''; + + $token = $sql->single( + "SELECT * FROM access_tokens WHERE uuid = ?", + "s", + [$uuid] + ); + + if (!$token) exit('UUID nicht gefunden'); + + if ($_SERVER['REQUEST_METHOD'] === 'POST') { - // Rechte neu setzen $sql->set( "DELETE FROM token_permissions WHERE token_id = ?", "i", [$token['id']] ); - foreach ($fields as $key) { + foreach ($_POST['fields'] ?? [] as $key) { $sql->set( "INSERT INTO token_permissions (token_id, field_key) VALUES (?, ?)", @@ -124,96 +346,91 @@ if ($uuid) { ); } - $saved = true; + $sql->set( + "UPDATE access_tokens SET notes = ? WHERE id = ?", + "si", + [trim($_POST['notes']), $token['id']] + ); } - // Alle Felder der Identität - $allFields = $sql->get( - "SELECT DISTINCT field_key FROM identity_fields WHERE identity_id = ?", + // Alle Felder der zugehörigen Identität + $fields = $sql->get( + "SELECT field_key, field_value FROM identity_fields WHERE identity_id = ?", "i", [$token['identity_id']] ); - // Aktive Rechte - $allowed = $sql->get( - "SELECT field_key FROM token_permissions WHERE token_id = ?", - "i", - [$token['id']] + // Welche Felder aktuell für diesen Token erlaubt sind + $allowed = array_column( + $sql->get( + "SELECT field_key FROM token_permissions WHERE token_id = ?", + "i", + [$token['id']] + ), + 'field_key' ); - $allowedKeys = array_column($allowed, 'field_key'); + // Name der Identität + $identity = $sql->single( + "SELECT name FROM identities WHERE id = ?", + "i", + [$token['identity_id']] + ); ?> - - - - - UUID bearbeiten - - -

UUID verwalten

-

+ +UUID bearbeiten + +

UUID bearbeiten

+

UUID:

+

Identität:

- Gespeichert ✔

'; ?> +
+

Sichtbare Felder

+ +
+ - -

Sichtbare Informationen

+

Notiz

+ +
+ +
- -
- - -

Ausgegeben an

- - -

- - - -

← Zurück

- - - ← zurück

+ +get("SELECT * FROM identities ORDER BY id DESC"); -$tokens = $sql->get("SELECT * FROM access_tokens ORDER BY created_at DESC"); - ?> - - - Admin Dashboard - +Admin -

Admin Dashboard

-

Identitäten

- +

Admin Dashboard

-

UUIDs

- +

➕ Identität anlegen

-

Logout

+ + +

Logout